CHISSP Healthcare IT Network Security & Access Control 1 — Questions and Answers
Question 1: Which network segmentation strategy is most commonly recommended to isolate medical devices from general hospital IT systems?
- VLAN-based segmentation with strict ACLs (Correct answer)
- Physical air-gapping of all clinical devices
- Using a single flat network with host-based firewalls
- Implementing NAT for all medical device traffic
Correct answer: VLAN-based segmentation with strict ACLs
VLAN-based segmentation with strict access control lists allows medical devices to be logically isolated while still permitting controlled, monitored communication with clinical systems.
Question 2: A hospital's EHR system must enforce the 'minimum necessary' access principle. Which access control model best supports this requirement?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Mandatory Access Control (MAC)
- Rule-Based Access Control (RuBAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns access rights based on clinical roles, ensuring each user only accesses information necessary for their specific job function, directly supporting the HIPAA minimum necessary standard.
Question 3: Under NIST guidelines, what is the primary purpose of implementing 802.1X port-based authentication on a healthcare network?
- To encrypt data transmitted between medical devices
- To ensure only authenticated devices connect to network segments (Correct answer)
- To monitor bandwidth usage by clinical applications
- To assign IP addresses dynamically to medical devices
Correct answer: To ensure only authenticated devices connect to network segments
802.1X port-based authentication prevents unauthorized devices from connecting to the network by requiring successful authentication before granting network access.
Question 4: A healthcare organization wants to reduce the attack surface of its patient portal. Which principle should guide the configuration of the web application firewall?
- Allow all traffic by default and block known malicious patterns
- Deny all traffic by default and allow only required application functions (Correct answer)
- Block traffic from foreign IP addresses exclusively
- Allow authenticated users unrestricted access to all portal features
Correct answer: Deny all traffic by default and allow only required application functions
A default-deny (whitelisting) approach minimizes attack surface by blocking all traffic except explicitly permitted application functions, reducing exposure to unknown threats.
Question 5: Which authentication mechanism provides the strongest security for remote access to a healthcare organization's clinical systems?
- Username and password with complexity requirements
- Multi-factor authentication combining something you know and something you have (Correct answer)
- Biometric fingerprint authentication alone
- Single sign-on with a shared administrative account
Correct answer: Multi-factor authentication combining something you know and something you have
Multi-factor authentication requiring two different credential types (e.g., password plus a hardware token) significantly reduces the risk of unauthorized access even if one factor is compromised.
Question 6: When deploying wireless networks in a healthcare facility, which protocol is considered minimum acceptable for securing patient data transmitted over Wi-Fi?
- WEP (Wired Equivalent Privacy)
- WPA (Wi-Fi Protected Access)
- WPA2 with AES-CCMP (Correct answer)
- WPA3 is required; no other protocol is acceptable
Correct answer: WPA2 with AES-CCMP
WPA2 with AES-CCMP is the minimum acceptable standard because WEP and original WPA have known cryptographic weaknesses that make them unsuitable for protecting ePHI.
Question 7: A security analyst detects repeated failed login attempts against the hospital's VPN concentrator from external IP addresses. What is the BEST immediate response?
- Disable the VPN service until the source is identified
- Implement account lockout policies and geo-IP blocking where feasible (Correct answer)
- Increase the VPN session timeout to reduce login frequency
- Switch from certificate-based to password-based VPN authentication
Correct answer: Implement account lockout policies and geo-IP blocking where feasible
Account lockout policies slow brute-force attacks while geo-IP blocking reduces attack surface from high-risk regions, balancing security with operational continuity.
CHISSP Healthcare IT Network Security & Access Control 1
Which network segmentation strategy is most commonly recommended to isolate medical devices from general hospital IT systems?